142 lines
5.3 KiB
Text
142 lines
5.3 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-18:05.ipsec Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: ipsec crash or denial of service
|
|
|
|
Category: core
|
|
Module: ipsec
|
|
Announced: 2018-04-04
|
|
Credits: Maxime Villard
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2018-01-31 09:24:48 UTC (stable/11, 11.1-STABLE)
|
|
2018-04-04 05:37:52 UTC (releng/11.1, 11.1-RELEASE-p9)
|
|
2018-01-31 09:26:28 UTC (stable/10, 10.4-STABLE)
|
|
2018-04-04 05:37:52 UTC (releng/10.4, 10.4-RELEASE-p8)
|
|
2018-04-04 05:37:52 UTC (releng/10.3, 10.3-RELEASE-p29)
|
|
CVE Name: CVE-2018-6918
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The IPsec suite of protocols provide network level security for IPv4 and IPv6
|
|
packets. FreeBSD includes software originally developed by the KAME project
|
|
which implements the various protocols that make up IPsec.
|
|
|
|
In IPsec, the IP Authentication Header (AH) is used to provide protection
|
|
against replay attacks and connectionless integrity and data origin
|
|
authentication for IP datagrams.
|
|
|
|
II. Problem Description
|
|
|
|
The length field of the option header does not count the size of the option
|
|
header itself. This causes a problem when the length is zero, the count is
|
|
then incremented by zero, which causes an infinite loop.
|
|
|
|
In addition there are pointer/offset mistakes in the handling of IPv4
|
|
options.
|
|
|
|
III. Impact
|
|
|
|
A remote attacker who is able to send an arbitrary packet, could cause the
|
|
remote target machine to crash.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available. Note that in FreeBSD 10 IPsec is not included
|
|
in the kernel by default, but it is in FreeBSD 11.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
Afterward, reboot the system.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
Afterward, reboot the system.
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:05/ipsec.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:05/ipsec.patch.asc
|
|
# gpg --verify ipsec.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/10/ r328621
|
|
releng/10.3/ r331985
|
|
releng/10.4/ r331985
|
|
stable/11/ r328620
|
|
releng/11.1/ r331985
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6918>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlrEZuRfFIAAAAAALgAo
|
|
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
|
|
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
|
|
5cKpOxAAlcyr88qHimXmMWNelNe+RvNkRoQwlmOw5XCWmWFGt4bX6KyrPSNVkZXK
|
|
9bZr0+sYiEjHPstXy+F6v95wqShRiefwpLVNJkP6LFKdQJeuxy0Uwsgl/i3aZVHy
|
|
q4iM+PgnMwt5FxzmIcFHjwZSGGaOw5p9dMlkFLxXQ6chafPutMbgkXMIGVGXEp4e
|
|
iwQgmh7j5LbUED0P9G7sYpcEN+DKZLWIyvz6L/AJmeHC/Z21TTeOoPjNPImgUmeU
|
|
R2gK6WrQ5hfDvvFIJK1RvkR7OGdgrw0p2bCeeW8HRR5WEifO+a5Mb6+S414jWLYi
|
|
uPYoxWf5NP92b9r3sLjNXbbsZ71mOZ49nZO3gc83O4mqOo9FYbTZ1W9C1UIO66pO
|
|
bsp9e7g09gvT/VTO9j2Bu9nNdLd41Jx6NCmrrJAPP5fp7yhgtI7a+voF+swyBPSq
|
|
kzSrNuY+PAnEvvAPzCz97uQQWabwbJoZNlPc+9IWZ7K++8N9j0K94dtsy8g6FMIT
|
|
A54s3LX9X5v+EYEwqnbNgEZxkSgjgpQkbnQC3evBwVkSgm0aQb4jRXoe9aY6KGtA
|
|
pSldkfyC364h8KNM1tbMq02fAIGDdBc+TbxjPabdc+FNmwVT+KlW/cBDy8J/rUhz
|
|
BSyWQdVwjHZ45R4Vmf8pEDA4/uc/L7XnMuqwgn2gBe23riiAjDM=
|
|
=WcBl
|
|
-----END PGP SIGNATURE-----
|